SUSE-SU-2026:4368-1

SUSE-SU-2026:4368-1 · Security update for libsodium

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

This update for libsodium fixes the following issues: Update to 1.0.22 (jsc#PED-16890): * Post-quantum key encapsulation is now available. ML-KEM768, the NIST-standardized lattice-based KEM, is accessible through the crypto_kem_mlkem768_*() functions. * X-Wing, a hybrid KEM combining ML-KEM768 with X25519 for protection against both classical and quantum adversaries, is available through the crypto_kem_*() functions. X-Wing is the recommended KEM for most applications. * SHA-3 hash functions are now available as crypto_hash_sha3256_*() and crypto_hash_sha3512_*(), with both one-shot and streaming APIs. * Performance: NEON optimizations for Argon2 on ARM platforms. * Performance: SHA3 (Keccak1600) now leverages ARM SHA3 instructions when available on ARM platforms. * Performance: WebAssembly SIMD implementations of Argon2 have been added. * XOF state alignment has been relaxed. * crypto_core_keccak1600_state has been added. * Export missing crypto_ipcrypt_nd_keygen() helper function. * crypto_auth_hmacsha256_init and crypto_auth_hmacsha512_init now accept NULL key pointers (with a zero key length), for consistency with other _init functions. * Fixed compilation with GCC on aarch64 and gcc 4.x. * On aarch64, aes256-gcm is now enabled even when not using clang, including MSVC. * Libsodium can be directly used as a dependency in a Zig project. Update to 1.0.21 (bsc#1256070, CVE-2025-15444, bsc#1255764, CVE-2025-69277): * The new crypto_ipcrypt_* functions implement mechanisms for securely encrypting and anonymizing IP addresses. * The sodium_bin2ip and sodium_ip2bin helper functions have been added to complement the crypto_ipcrypt_* functions and easily convert addresses between bytes and strings. * XOF: the crypto_xof_shake* and crypto_xof_turboshake* functions are * standard extendable output functions. From input of any length, they can derive output of any length with the same properties as hash functions. These primitives are required by many post-quantum mechanisms, but can also be used for a wide range of applications, including key derivation, session encryption and more. * Performance of AES256-GCM and AEGIS on ARM has been improved with some compilers * Security: optblockers have been introduced in critical code paths to prevent compilers from introducing unwanted side channels via conditional jumps. This was observed on RISC-V targets with specific compilers and options. * Security: crypto_core_ed25519_is_valid_point() now properly rejects small-order points that are not in the main subgroup * ((nonnull)) attributes have been relaxed on some crypto_stream* functions to allow NULL output buffers when the output length is zero * A cross-compilation issue with old clang versions has been fixed * crypto_aead_aes256gcm_is_available is exported to JavaScript * Security: memory fences have been added after MAC verification in AEAD to prevent speculative access to plaintext before authentication is complete * Assembly files now include .gnu.property notes for proper IBT and Shadow Stack support when building with CET instrumentation. Update to 1.0.20: * build system updates and portability fixes Includes changes from 1.0.19: * New AEADs: AEGIS-128L and AEGIS-256 * The HKDF key derivation mechanism, required by many standard protocols - A test designed to trigger an OOM condition didn't work on Linux systems with memory overcommit turned on. It has been - Emscripten: UTF8ToString() is now exported since - New target: WebAssembly/WASI - New functions to map a hash to an edwards25519 point or get a random point: - crypto_core_ed25519_scalar_mul() has been implemented for - Support for the Ristretto group has been implemented for - Bug fix: sodium_pad() didn't properly support block sizes - JS/WebAssembly: some old iOS versions can't instantiate the crypto_pwhash_scryptsalsa208sha256_str_needs_rehash()didn't returnEINVAL` on input strings with a short length, unlike - Added a workaround for Visual Studio 2010 bug causing CPU - New low-level APIs for arithmetic mod the order of the prime - crypto_core_ed25519_scalar_random(), - crypto_core_ed25519_scalar_invert(), - crypto_core_ed25519_scalar_complement(), crypto_core_ed25519_scalar_add() and crypto_scalarmult_ed25519_base_noclamp() and crypto_scalarmult_ed25519_noclamp(). * AVX2 detection is more reliable. Intel platforms. crypto_generichash() is now faster than MD5 and * In addition to sodium_bin2hex(), sodium_hex2bin() is now a * crypto_generichash_statebytes(), crypto_auth_*_statebytes() and crypto_hash_*_statebytes() have been added in order to retrieve the size of structures keeping states from foreign * The JavaScript target doesn't require /dev/urandom or an external randombytes() implementation any more. Other minor Emscripten-related improvements have been made in order to * Custom randombytes implementations do not need to provide their own implementation of randombytes_uniform() any more. randombytes_stir() and randombytes_close() can also be NULL * On Linux, getrandom(2) is being used instead of directly accessing /dev/urandom, if the kernel supports this system Also libsodium users were rebuilt: zeromq, dnsdist, unbound, php7, and usbguard.

Fix available

Published

2026-09-28T15:06:19Z

Updated

2026-09-29T09:15:10.902986228Z

Stack: system

Check your server →